dsdb: read acl, sd can be null and ret == LDB_SUCCESS